[Zuk Z1 Android Development] btme:
I've managed to compile TWRP with working decryption. The attached zip is not flashable by TWRP (at least I don't think it is). I just zipped it so that I could work around the 8 MB file limit for img files.

For anyone curious how I did this (or wants to do it himself):

I set up the cyanogenmod source using https://wiki.cyanogenmod.org/w/Build_for_ham.

Then I added a local manifest containing

<?xml version="1.0" encoding="UTF-8"?>
<manifest>
<remove-project name="CyanogenMod/android_bootable_recovery" />
<project path="bootable/recovery" name="omnirom/android_bootable_recovery" clone-depth="1" remote="github" revision="android-6.0" />
<project path="external/busybox" name="omnirom/android_external_busybox" clone-depth="1" remote="github" revision="android-6.0" />
</manifest>

I added

-bin/linker
-firmware/keymaste.b00
-firmware/keymaste.b01
-firmware/keymaste.b02
-firmware/keymaste.b03
-firmware/keymaste.mdt
-firmware/cmnlib.b00
-firmware/cmnlib.b01
-firmware/cmnlib.b02
-firmware/cmnlib.b03
-firmware/cmnlib.mdt

to device/zuk/ham/proprietary-files-qc.txt.

Added the file device/zuk/ham/twrp.fstab

/cache ext4 /dev/block/bootdevice/by-name/cache
/system ext4 /dev/block/bootdevice/by-name/system
/data ext4 /dev/block/bootdevice/by-name/userdata nosuid,nodev,barrier=1,noauto_da_alloc wait,check,formattable,encryptable=footer,length=-16384
/persist ext4 /dev/block/bootdevice/by-name/persist
/boot emmc /dev/block/bootdevice/by-name/boot
/recovery emmc /dev/block/bootdevice/by-name/recovery
#/misc emmc /dev/block/bootdevice/by-name/misc
/firmware vfat /dev/block/mmcblk0p1 ro,shortname=lower,uid=1000,gid=1000,dmask=227,fmask=337,context=u:object_r:firmware_file:s0 wait
/usb-otg auto /devices/platform/xhci-hcd flags=display="USB OTG";storage;wipeingui;removable
/sdcard1 auto /devices/msm_sdcc.2/mmc_host* flags=storage;removable;encryptable=userdata

Added

# Recovery
#TARGET_RECOVERY_FSTAB := $(DEVICE_PATH)/rootdir/etc/fstab.qcom

# TWRP Settings
DEVICE_RESOLUTION := 1080x1920
TARGET_RECOVERY_PIXEL_FORMAT := "RGBX_8888"
BOARD_USE_CUSTOM_RECOVERY_FONT := \"roboto_23x41.h\"
TW_INTERNAL_STORAGE_PATH := "/sdcard"
TW_INTERNAL_STORAGE_MOUNT_POINT := "sdcard"
TW_FLASH_FROM_STORAGE := true
TW_BRIGHTNESS_PATH := /sys/class/leds/lcd-backlight/brightness
RECOVERY_GRAPHICS_USE_LINELENGTH := true
BOARD_HAS_NO_SELECT_BUTTON := true
RECOVERY_SDCARD_ON_DATA := true
TW_INCLUDE_CRYPTO := true

COMMON_GLOBAL_CFLAGS += -DNO_SECURE_DISCARD
BOARD_SUPPRESS_EMMC_WIPE := true

PRODUCT_COPY_FILES += device/zuk/ham/twrp.fstab:recovery/root/etc/twrp.fstab

ifneq ($(TARGET_RECOVERY_ROOT_OUT),)
$(shell mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/firmware/image)
$(shell mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/vendor/lib/hw)
$(shell ln -s /sbin $(TARGET_RECOVERY_ROOT_OUT)/system/bin)
endif

PRODUCT_COPY_FILES += \
vendor/zuk/ham/proprietary/bin/qseecomd:recovery/root/system/bin/qseecomd \
vendor/zuk/ham/proprietary/bin/linker:recovery/root/system/bin/linker \
vendor/zuk/ham/proprietary/vendor/lib/libssd.so:recovery/root/vendor/lib/libssd.so \
vendor/zuk/ham/proprietary/vendor/lib/librpmb.so:recovery/root/vendor/lib/librpmb.so \
vendor/zuk/ham/proprietary/vendor/lib/libdiag.so:recovery/root/vendor/lib/libdiag.so \
vendor/zuk/ham/proprietary/vendor/lib/libdrmfs.so:recovery/root/vendor/lib/libdrmfs.so \
vendor/zuk/ham/proprietary/vendor/lib/libQSEEComAPI.so:recovery/root/vendor/lib/libQSEEComAPI.so \
vendor/zuk/ham/proprietary/vendor/lib/libdrmtime.so:recovery/root/vendor/lib/libdrmtime.so \
vendor/zuk/ham/proprietary/lib/hw/keystore.msm8974.so:recovery/root/vendor/lib/hw/keystore.msm8974.so \
vendor/zuk/ham/proprietary/firmware/image/keymaste.b00:recovery/root/firmware/image/keymaste.b00 \
vendor/zuk/ham/proprietary/firmware/image/keymaste.b01:recovery/root/firmware/image/keymaste.b01 \
vendor/zuk/ham/proprietary/firmware/image/keymaste.b02:recovery/root/firmware/image/keymaste.b02 \
vendor/zuk/ham/proprietary/firmware/image/keymaste.b03:recovery/root/firmware/image/keymaste.b03 \
vendor/zuk/ham/proprietary/firmware/image/keymaste.mdt:recovery/root/firmware/image/keymaste.mdt \
vendor/zuk/ham/proprietary/firmware/image/cmnlib.b00:recovery/root/firmware/image/cmnlib.b00 \
vendor/zuk/ham/proprietary/firmware/image/cmnlib.b01:recovery/root/firmware/image/cmnlib.b01 \
vendor/zuk/ham/proprietary/firmware/image/cmnlib.b02:recovery/root/firmware/image/cmnlib.b02 \
vendor/zuk/ham/proprietary/firmware/image/cmnlib.b03:recovery/root/firmware/image/cmnlib.b03 \
vendor/zuk/ham/proprietary/firmware/image/cmnlib.mdt:recovery/root/firmware/image/cmnlib.mdt

to device/zuk/ham/BoardConfig.mk. Please note the commented TARGET_RECOVERY_FSTAB.

And added

on fs
service qseecomd /system/bin/qseecomd

to device/zuk/ham/rootdir/etc/init.recovery.qcom.rc.

Then I just compiled TWRP and it finally (after many trials and errors) worked.

acran from https://github.com/TeamWin/android_device_oneplus_oneplus2/issues/1 gave me the final tips needed to get it working.

Next I'll try to get it pulled into official TWRP. But I don't know if that is possible with all the proprietary files needed.

Edit: I tried it with a password and a PIN. I didn't test it with a pattern. But as I had to enter the PIN via a normal keyboard I guess that it will be the same with a pattern.